generated: '2026-08-29'
method: searched
source: https://hackerone.com/qlik
provider: QlikView
providerId: qlikview
description: >-
  Vulnerability disclosure posture for Qlik, the vendor of QlikView. Qlik runs a published
  Vulnerability Disclosure Policy on HackerOne and documents a Product Security and
  Vulnerability Policy on the Qlik Community. There is no /.well-known/security.txt on any
  Qlik host - every probe returned 404 on 2026-08-29 - so the program is discoverable by
  search but not by the machine-readable RFC 9116 path.
program:
  present: true
  type: vulnerability-disclosure-policy
  platform: HackerOne
  url: https://hackerone.com/qlik
  status: 200
  bounty: unknown
  bounty_note: >-
    Listed as a Vulnerability Disclosure Policy. Whether monetary bounties are paid is not
    asserted here because the program page does not state it in the fetched content.
policy:
  url: https://community.qlik.com/t5/Official-Support-Articles/Qlik-Product-Security-and-Vulnerability-Policy/ta-p/1713629
  status: 200
  name: Qlik Product Security and Vulnerability Policy
  summary: >-
    Qlik follows a Responsible Disclosure approach for any vulnerability its Software
    Security Office rates High or Critical: publish a Security Bulletin to alert customers
    and partners, collaborate with the reporter, and ship a fix or a mitigation. Qlik's
    Software Security Office runs static code analysis, threat modelling, third-party
    vulnerability scanning and penetration testing as part of the SDLC.
contacts:
  - type: email
    value: security@qlik.com
    source: https://www.qlik.com/us/trust
  - type: support
    value: https://community.qlik.com/t5/Support/ct-p/qlikSupport
security_txt:
  present: false
  probed:
    - url: https://www.qlik.com/.well-known/security.txt
      status: 404
    - url: https://qlik.com/.well-known/security.txt
      status: 404
    - url: https://help.qlik.com/.well-known/security.txt
      status: 404
    - url: https://qlik.dev/.well-known/security.txt
      status: 404
    - url: https://community.qlik.com/.well-known/security.txt
      status: 404
  note: >-
    A finding worth reporting back to Qlik: the disclosure program exists and is good, but
    an automated scanner following RFC 9116 will not find it. One security.txt at
    www.qlik.com pointing at hackerone.com/qlik would close that gap.
evidence:
  - url: https://hackerone.com/qlik
    status: 200
    fetched: '2026-08-29'
  - url: https://community.qlik.com/t5/Official-Support-Articles/Qlik-Product-Security-and-Vulnerability-Policy/ta-p/1713629
    status: 200
    fetched: '2026-08-29'
  - url: https://www.qlik.com/us/trust
    status: 200
    fetched: '2026-08-29'
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com